Admin Role Change Audit

3 Nodes Trigger: Unbekannt

Workflow Diagramm

Auto-generiert

graph LR
    N0["🔧 Poll Audit Logs"]
    N1["🔧 Filter Critical Roles"]
    N2["🔧 Security Alert"]
    N0 --> N1
    N1 --> N2

    classDef trigger fill:#f59e0b,stroke:#b45309,color:#000
    classDef action fill:#292524,stroke:#44403c,color:#e7e5e4
    classDef logic fill:#1e1b4b,stroke:#4338ca,color:#c7d2fe
    class N0 action
    class N1 action
    class N2 action

Nodes im Workflow

Poll Audit Logs

Http Request

Filter Critical Roles

Function

Security Alert

Microsoft Teams

Workflow Beschreibung

n8n Workflow

Importiere diesen JSON-Code direkt in deine n8n Instanz.

**Name im Flow**: 06_Admin_Role_Change_Audit

{
    "name": "06_Admin_Role_Change_Audit",
    "nodes": [
        {
            "parameters": {
                "pollInterval": "5m",
                "authentication": "predefinedCredentialType",
                "nodeCredentialType": "microsoftGraphOAuth2Api",
                "url": "https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?$filter=activityDisplayName eq 'Add member to role' and result eq 'success'",
                "options": {}
            },
            "name": "Poll Audit Logs",
            "type": "n8n-nodes-base.httpRequest",
            "typeVersion": 3,
            "position": [
                250,
                300
            ],
            "credentials": {
                "microsoftGraphOAuth2Api": {
                    "id": "YOUR_CREDENTIAL_ID",
                    "name": "Microsoft Graph Account"
                }
            }
        },
        {
            "parameters": {
                "functionCode": "const criticalRoles = ['Global Administrator', 'Intune Administrator', 'Security Administrator'];nreturn items.filter(item => {n  const roles = item.json.targetResources.filter(r => r.type === 'Role');n  return roles.some(r => criticalRoles.includes(r.displayName));n});"
            },
            "name": "Filter Critical Roles",
            "type": "n8n-nodes-base.function",
            "typeVersion": 1,
            "position": [
                450,
                300
            ]
        },
        {
            "parameters": {
                "resource": "chat",
                "message": "=🚨 **Security Alert** 🚨nA user was added to a critical role:nn**Actor:** {{ $json.initiatedBy.user.displayName }}n**Target:** {{ $json.targetResources[0].userPrincipalName }}n**Role:** {{ $json.targetResources[0].modifiedProperties[1].newValue }}"
            },
            "name": "Security Alert",
            "type": "n8n-nodes-base.microsoftTeams",
            "typeVersion": 1,
            "position": [
                650,
                300
            ]
        }
    ],
    "connections": {
        "Poll Audit Logs": {
            "main": [
                [
                    {
                        "node": "Filter Critical Roles",
                        "type": "main",
                        "index": 0
                    }
                ]
            ]
        },
        "Filter Critical Roles": {
            "main": [
                [
                    {
                        "node": "Security Alert",
                        "type": "main",
                        "index": 0
                    }
                ]
            ]
        }
    }
}

So importierst du diesen Workflow

Klappe den JSON Code oben auf und klicke Kopieren.
Öffne dein n8n Dashboard.
Drücke Strg+V direkt im Editor.

Dateiname 06_Admin_Role_Change_Audit.json

Auf GitHub ansehen